Extracted

• • Target

    86f8e1a00e91963460ef2da434ea1472fafe70f3b60eb4e578d79c9bc72b1610

  • Size

    546KB

  • MD5

    8dc1b4eeef3d2cda0c316b328bc15292

  • SHA1

    3245ac5613ff65fedb94b9047606f5e138ec6dbb

  • SHA256

    86f8e1a00e91963460ef2da434ea1472fafe70f3b60eb4e578d79c9bc72b1610

  • SHA512

    9deb7b2580d5216e9ea030d2f0cdd652f5e5bdaed4dcfc693f57fc4f0682706d72ab47c500c030b48f0dd72e291e7b05bab0158a2e5e307ffa7cb82d79aeb8aa

  • SSDEEP

    12288:P0yEn6z3unjsUxZdLRrbK/WH6nsb1tz1VzYKj86sNJRL:8vn6z3ujN7lBz1pYO6Jt

  Score

  10^/10

  cybergateminabootkitpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2